# Nuclei v3.10.0

- Product: Nuclei (https://whatsnew.fyi/product/nuclei)
- Vendor: ProjectDiscovery
- Date: 2026-06-30
- Version: v3.10.0
- Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0
- Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.10.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Centralize opt-in capability gating across loaders and workflows
- **security** — Gate allowAllFiles behind -lfa flag
- **security** — Validate code template signatures before DAST loading
- **security** — Update Goja dependency
- **security** — Enforce template rendering boundary in DAST/fuzz mode
- **added** — Add per-host HTTP client pooling
- **fixed** — Fix handling in hosterrorscache to automatically skip hosts that consistently time out
- **fixed** — Fix preservation of explicit target port in network templates
- **fixed** — Fix connection reuse and improve port pre-flight handling
- **fixed** — Fix ASCII-section regex to properly escape literal dot
- **fixed** — Fix recording of decoded bytes for debug dumps
- **fixed** — Fix proper escaping of dbname in lib/pq URLs
- **fixed** — Fix network policy enforcement prior to LDAP dialing
- **fixed** — Fix normalization and rejection of trace file DSN options in Oracle
- **fixed** — Fix proper escaping of MSSQL database names in connection URLs
- **fixed** — Fix krbforge to reject unsandboxed ccache writes
- **fixed** — Fix rejection of request-condition(s) during fuzzing
- **fixed** — Fix YAML to correctly reject recursive include chains
- **fixed** — Fix resource leaks
- **changed** — Update govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input

##### What's Changed

###### Security Fixes

- **Templates**: Centralize opt-in capability gating across loaders and workflows by @dwisiswant0 (#7489)
  - [GHSA-qgw5-7j4f-fg97](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97)
- **JS/MySQL**: Gate `allowAllFiles` behind `-lfa` by @dogancanbakir (#7473)
  - [GHSA-xhmx-w2j4-rw3q](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q)
- **Templates**: Validate code template signatures before DAST loading by @dogancanbakir (#7472)
  - [GHSA-jpf4-98qj-qr67](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpf4-98qj-qr67)
- **JS**: Update Goja dependency by @Mzack9999 (#7467)
  - [GHSA-vxg7-f2jj-jmqm](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-vxg7-f2jj-jmqm)
- **Protocols**: Enforce template rendering boundary in DAST/fuzz mode by @dwisiswant0 (#7499)
  - [GHSA-jpvm-9frm-hjcq](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpvm-9frm-hjcq)

###### 🎉 New Features
* Added per-host HTTP client pooling by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7301

###### 🐞 Bug Fixes
* Fixed handling in hosterrorscache to automatically skip hosts that consistently time out by @knakul853 in https://github.com/projectdiscovery/nuclei/pull/7455
* Fixed preservation of explicit target port in network templates (fixes #7323) by @XananasX7 in https://github.com/projectdiscovery/nuclei/pull/7465
* Fixed connection reuse and improved port pre-flight handling by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6715
* Fixed ASCII-section regex to properly escape literal `.` by @snicket2100 in https://github.com/projectdiscovery/nuclei/pull/7476
* Fixed recording of decoded bytes for debug dumps by @snicket2100 in https://github.com/projectdiscovery/nuclei/pull/7478
* Fixed proper escaping of dbname in lib/pq URLs by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7479
* Fixed network policy enforcement prior to LDAP dialing by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7494
* Fixed normalization and rejection of trace file DSN options in Oracle by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7480
* Fixed proper escaping of MSSQL database names in connection URLs by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7481
* Fixed krbforge to reject unsandboxed ccache writes by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7482
* Fixed rejection of request-condition(s) during fuzzing by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7466
* Fixed: YAML now correctly rejects recursive include chains by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7492
* Fixed resource leaks by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7502

###### Other Changes
* Updated govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input by @XananasX7 in https://github.com/projectdiscovery/nuclei/pull/7464
* Updated dependencies to remove unused packages by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7457
* Added fuzzing parser harnesses for raw requests and templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7459

##### New Contributors
* @XananasX7 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7465
* @snicket2100 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7476

**Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.9.0...v3.10.0